The US Defense Advanced Research Projects Agency (DARPA) has reported back on its first ever security bug bounty program, saying the scheme has highlighted strengths as well as weaknesses.
Finding Exploits to Thwart Tampering (FETT) formed part of the ‘Hack the Pentagon’ crowdsourced digital defense program.
As previously reported, the bug bounty was set up to evaluate the hardware architectures developed under DARPA’s System Security Integration Through Hardware and Firmware (SSITH) program.
SSITH aims to develop security architectures and tools to protect against common types of hardware vulnerability that can be exploited through software exploits.
More than 980 SSITH processors were tested by researchers from crowdsourced security platform Synack.
A total of 10 vulnerabilities were found – seven critical and three high – with most of the critical vulnerabilities down to interactions between the SSITH hardware, SSITH firmware and the operating system software.
According to DARPA, four of the flaws have been patched so far, and the agency expects to resolve the rest soon.
“FETT both proved the value of the secure hardware architectures in development on the SSITH program, and challenged the research teams to further advance and mature the technology,” Keith Rebello, the program manager responsible for the SSITH program and the FETT bug bounty, tells The Daily Swig.
“The bug reports generated by Synack’s cyber analysts provided actionable information that is helping drive continued development during the final phase of the program.”
The program also led to the creation of a scalable, virtualized platform for remotely testing and evaluating secure processor prototypes.
It allows for the virtual crowdsourcing of processor analysis and hacking, and, says Rebello, can be used again for future processor technology evaluations.
DARPA plans to open-source the platform – along with some of its RISC-V designs – for future use.
“The final phase of the program will focus on continuing to advance the secure processors in development, ensuring they can protect against all of the weaknesses from the seven classes of the CWE hardware vulnerability classes that SSITH is focused on,” says Rebello.
“We are also planning to take the final SSITH processor designs and fabricate a SSITH processor to evaluate performance in silicon.”
Source: https://portswigger.net/daily-swig/darpa-bug-bounty-helps-strengthen-military-research-agencys-security-defenses
